API Keys

Every key pair is created and revoked in a single GraphQL call — there's no separate "create public" vs "create secret" step, and no key type parameter to get wrong.

Create a key pair

From Dashboard → API Keys, or directly via GraphQL:

mutation

mutation {
  createApiKey(name: "Production backend", sdkType: WEB) {
    keyPairId
    publicKey   # certilayer_live_pk_... — safe for frontend
    secretKey   # certilayer_live_sk_... — backend only, shown once
  }
}

U0001f6ab

The secret key is returned exactly once, at creation time. CertiLayer never stores it in plaintext (only a BLAKE3 hash) and cannot show it to you again — save it immediately.

Revoke a key

mutation

mutation {
  revokeApiKey(keyId: "...")
}

Revocation is immediate — any request using that key starts returning 401 right away, with no propagation delay.

ℹ️

See Authentication for the difference between public and secret keys and where each is safe to use.